9729f58618e8d6f9f82076ab505afc0090b2e15f5912e67b95718fb6e7e7d8b8

Analysis

max time kernel
151s
max time network
162s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 18:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9729f58618e8d6f9f82076ab505afc0090b2e15f5912e67b95718fb6e7e7d8b8.exe
Size

100KB
MD5

085eb4e18b8c457169a2fffb1c9066e6
SHA1

9095bba56686e6dc1e1542ac2ae7dcd4a950678f
SHA256

9729f58618e8d6f9f82076ab505afc0090b2e15f5912e67b95718fb6e7e7d8b8
SHA512

bb1617be13f230c86b4b3357a0c954818c552dc8f95e88a674e3f9e8e30c04b2c992f39be015a3fbbd755ccbd7584fe814efd2dc7a423c29d8613a455aa3119c
SSDEEP

1536:hUqBWUSFNrdN90DukJi/gI7xxtco1MIcN91uIJ++VYVwtSZuhEJAiCi2MIZQwjj+:2GW3B+DukJ45LIFu4+UEC6FISw/lir

Score

8^/10

bootkit persistence

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
1900	install.exe
1672	setup.exe
756	lsyci.exe
588	lsyfi.exe
1816	lsyci.exe
1784	lsyfi.exe

Loads dropped DLL 17 IoCs

pid	Process
1228	9729f58618e8d6f9f82076ab505afc0090b2e15f5912e67b95718fb6e7e7d8b8.exe
1228	9729f58618e8d6f9f82076ab505afc0090b2e15f5912e67b95718fb6e7e7d8b8.exe
1900	install.exe
1672	setup.exe
1900	install.exe
1672	setup.exe
1900	install.exe
1672	setup.exe
1672	setup.exe
1672	setup.exe
756	lsyci.exe
756	lsyci.exe
756	lsyci.exe
1232	rundll32.exe
1232	rundll32.exe
1232	rundll32.exe
1232	rundll32.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	lsyfi.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mssrcid.ini	setup.exe
File opened for modification	C:\Windows\SysWOW64\mssrcid.ini	lsyci.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	lsyci.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	lsyfi.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\sysrcid.ini	install.exe
File opened for modification	C:\Windows\sysrcid.ini	lsyfi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 63 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	lsyci.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{846206EA-1AC6-4A2C-B30E-D0A1D9D2F373}\WpadDecisionTime = 203fefb1440dd901	lsyfi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-90-92-a7-60-6a	lsyfi.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-90-92-a7-60-6a\WpadDecisionTime = 60ffb9b9440dd901	lsyfi.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{846206EA-1AC6-4A2C-B30E-D0A1D9D2F373}\WpadDecisionTime = a00441c0440dd901	lsyci.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	lsyfi.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	lsyfi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	lsyfi.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{846206EA-1AC6-4A2C-B30E-D0A1D9D2F373}\WpadDecisionTime = 0080dedd440dd901	lsyci.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-90-92-a7-60-6a\WpadDecision = "0"	lsyci.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	lsyfi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	lsyfi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{846206EA-1AC6-4A2C-B30E-D0A1D9D2F373}\WpadDecisionReason = "1"	lsyci.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	lsyci.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	lsyci.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{846206EA-1AC6-4A2C-B30E-D0A1D9D2F373}\8a-90-92-a7-60-6a	lsyci.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-90-92-a7-60-6a\WpadDecisionTime = 203fefb1440dd901	lsyfi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	lsyci.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	lsyci.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{846206EA-1AC6-4A2C-B30E-D0A1D9D2F373}\WpadNetworkName = "Network 3"	lsyfi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	lsyfi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-90-92-a7-60-6a\WpadDetectedUrl	lsyfi.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-90-92-a7-60-6a\WpadDecisionTime = a00441c0440dd901	lsyci.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	lsyci.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	lsyci.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-90-92-a7-60-6a	lsyci.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	lsyci.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	lsyfi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	lsyfi.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{846206EA-1AC6-4A2C-B30E-D0A1D9D2F373}\WpadDecisionTime = a00441c0440dd901	lsyfi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	lsyfi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	lsyfi.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0087000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	lsyci.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{846206EA-1AC6-4A2C-B30E-D0A1D9D2F373}\WpadDecisionTime = 60ffb9b9440dd901	lsyfi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	lsyci.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0087000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	lsyci.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{846206EA-1AC6-4A2C-B30E-D0A1D9D2F373}\WpadDecisionTime = 203fefb1440dd901	lsyci.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-90-92-a7-60-6a\WpadDecisionReason = "1"	lsyci.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000005000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0087000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	lsyci.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	lsyfi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{846206EA-1AC6-4A2C-B30E-D0A1D9D2F373}\WpadDecisionReason = "1"	lsyfi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{846206EA-1AC6-4A2C-B30E-D0A1D9D2F373}\8a-90-92-a7-60-6a	lsyfi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	lsyfi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-90-92-a7-60-6a\WpadDecision = "0"	lsyfi.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{846206EA-1AC6-4A2C-B30E-D0A1D9D2F373}\WpadDecisionTime = 207bcdb5440dd901	lsyfi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{846206EA-1AC6-4A2C-B30E-D0A1D9D2F373}	lsyfi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{846206EA-1AC6-4A2C-B30E-D0A1D9D2F373}\WpadDecision = "0"	lsyfi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{846206EA-1AC6-4A2C-B30E-D0A1D9D2F373}\WpadNetworkName = "Network 3"	lsyci.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-90-92-a7-60-6a\WpadDecisionTime = 207bcdb5440dd901	lsyfi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{846206EA-1AC6-4A2C-B30E-D0A1D9D2F373}	lsyci.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-90-92-a7-60-6a\WpadDecisionTime = 203fefb1440dd901	lsyci.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	lsyci.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-90-92-a7-60-6a\WpadDetectedUrl	lsyci.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	lsyci.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	lsyfi.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-90-92-a7-60-6a\WpadDecisionTime = 60ffb9b9440dd901	lsyci.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	lsyci.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	lsyci.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-90-92-a7-60-6a\WpadDecisionReason = "1"	lsyfi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{846206EA-1AC6-4A2C-B30E-D0A1D9D2F373}\WpadDecision = "0"	lsyci.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-90-92-a7-60-6a\WpadDecisionTime = a00441c0440dd901	lsyfi.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-90-92-a7-60-6a\WpadDecisionTime = 0080dedd440dd901	lsyci.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-90-92-a7-60-6a\WpadDecisionTime = 0080dedd440dd901	lsyfi.exe

Modifies registry class 31 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{01F02BB1-229E-402f-B3E9-B340647417F9}\ServiceParameters = "-Service"	lsyci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F02BB1-229E-402F-B3E9-B340647417F9}	lsyci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F02BB1-229E-402F-B3E9-B340647417F9}\1.0\FLAGS	lsyci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F02BB1-229E-402F-B3E9-B340647417F9}\1.0\0\win32	lsyci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6783C0A2-5356-4FCB-91C5-00BEB9113000}	lsyfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\usnsvc.EXE	lsyci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6783C0A2-5356-4FCB-91C5-00BEB9113000}\1.0\ = "usnsvc 1.0 Type Library"	lsyfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6783C0A2-5356-4FCB-91C5-00BEB9113000}\1.0\0	lsyfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6783C0A2-5356-4FCB-91C5-00BEB9113000}\1.0\0\win32	lsyfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{01F02BB1-229E-402f-B3E9-B340647417F9}	lsyci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F02BB1-229E-402F-B3E9-B340647417F9}\1.0\FLAGS\ = "0"	lsyci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F02BB1-229E-402F-B3E9-B340647417F9}\1.0	lsyci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{6783C0A2-5356-4fcb-91C5-00BEB9113000}\ServiceParameters = "-Service"	lsyfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6783C0A2-5356-4FCB-91C5-00BEB9113000}\1.0\HELPDIR	lsyfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6783C0A2-5356-4FCB-91C5-00BEB9113000}\1.0\HELPDIR\ = "C:\\Windows\\"	lsyfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\usnsvc.EXE\AppID = "{01F02BB1-229E-402f-B3E9-B340647417F9}"	lsyci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F02BB1-229E-402F-B3E9-B340647417F9}\1.0\0\win32\ = "C:\\Windows\\SysWOW64\\lsyci.exe"	lsyci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F02BB1-229E-402F-B3E9-B340647417F9}\1.0\HELPDIR\ = "C:\\Windows\\SysWOW64\\"	lsyci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\usnsvc.EXE\AppID = "{6783C0A2-5356-4fcb-91C5-00BEB9113000}"	lsyfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F02BB1-229E-402F-B3E9-B340647417F9}\1.0\HELPDIR	lsyci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6783C0A2-5356-4FCB-91C5-00BEB9113000}\1.0\FLAGS\ = "0"	lsyfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{01F02BB1-229E-402f-B3E9-B340647417F9}\LocalService = "usnsvc"	lsyci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F02BB1-229E-402F-B3E9-B340647417F9}\1.0\0	lsyci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{6783C0A2-5356-4fcb-91C5-00BEB9113000}	lsyfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{6783C0A2-5356-4fcb-91C5-00BEB9113000}\ = "nlpsa"	lsyfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{6783C0A2-5356-4fcb-91C5-00BEB9113000}\LocalService = "usnsvc"	lsyfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F02BB1-229E-402F-B3E9-B340647417F9}\1.0\ = "usnsvc 1.0 Type Library"	lsyci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6783C0A2-5356-4FCB-91C5-00BEB9113000}\1.0	lsyfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6783C0A2-5356-4FCB-91C5-00BEB9113000}\1.0\FLAGS	lsyfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6783C0A2-5356-4FCB-91C5-00BEB9113000}\1.0\0\win32\ = "C:\\Windows\\lsyfi.exe"	lsyfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{01F02BB1-229E-402f-B3E9-B340647417F9}\ = "winmgmtex"	lsyci.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1816	lsyci.exe
1816	lsyci.exe
1784	lsyfi.exe
1784	lsyfi.exe
1232	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1232	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1232	rundll32.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 1900	1228	9729f58618e8d6f9f82076ab505afc0090b2e15f5912e67b95718fb6e7e7d8b8.exe	27
PID 1228 wrote to memory of 1900	1228	9729f58618e8d6f9f82076ab505afc0090b2e15f5912e67b95718fb6e7e7d8b8.exe	27
PID 1228 wrote to memory of 1900	1228	9729f58618e8d6f9f82076ab505afc0090b2e15f5912e67b95718fb6e7e7d8b8.exe	27
PID 1228 wrote to memory of 1900	1228	9729f58618e8d6f9f82076ab505afc0090b2e15f5912e67b95718fb6e7e7d8b8.exe	27
PID 1228 wrote to memory of 1900	1228	9729f58618e8d6f9f82076ab505afc0090b2e15f5912e67b95718fb6e7e7d8b8.exe	27
PID 1228 wrote to memory of 1900	1228	9729f58618e8d6f9f82076ab505afc0090b2e15f5912e67b95718fb6e7e7d8b8.exe	27
PID 1228 wrote to memory of 1900	1228	9729f58618e8d6f9f82076ab505afc0090b2e15f5912e67b95718fb6e7e7d8b8.exe	27
PID 1228 wrote to memory of 1672	1228	9729f58618e8d6f9f82076ab505afc0090b2e15f5912e67b95718fb6e7e7d8b8.exe	28
PID 1228 wrote to memory of 1672	1228	9729f58618e8d6f9f82076ab505afc0090b2e15f5912e67b95718fb6e7e7d8b8.exe	28
PID 1228 wrote to memory of 1672	1228	9729f58618e8d6f9f82076ab505afc0090b2e15f5912e67b95718fb6e7e7d8b8.exe	28
PID 1228 wrote to memory of 1672	1228	9729f58618e8d6f9f82076ab505afc0090b2e15f5912e67b95718fb6e7e7d8b8.exe	28
PID 1228 wrote to memory of 1672	1228	9729f58618e8d6f9f82076ab505afc0090b2e15f5912e67b95718fb6e7e7d8b8.exe	28
PID 1228 wrote to memory of 1672	1228	9729f58618e8d6f9f82076ab505afc0090b2e15f5912e67b95718fb6e7e7d8b8.exe	28
PID 1228 wrote to memory of 1672	1228	9729f58618e8d6f9f82076ab505afc0090b2e15f5912e67b95718fb6e7e7d8b8.exe	28
PID 1672 wrote to memory of 756	1672	setup.exe	29
PID 1672 wrote to memory of 756	1672	setup.exe	29
PID 1672 wrote to memory of 756	1672	setup.exe	29
PID 1672 wrote to memory of 756	1672	setup.exe	29
PID 1672 wrote to memory of 756	1672	setup.exe	29
PID 1672 wrote to memory of 756	1672	setup.exe	29
PID 1672 wrote to memory of 756	1672	setup.exe	29
PID 1900 wrote to memory of 588	1900	install.exe	30
PID 1900 wrote to memory of 588	1900	install.exe	30
PID 1900 wrote to memory of 588	1900	install.exe	30
PID 1900 wrote to memory of 588	1900	install.exe	30
PID 1900 wrote to memory of 588	1900	install.exe	30
PID 1900 wrote to memory of 588	1900	install.exe	30
PID 1900 wrote to memory of 588	1900	install.exe	30
PID 1672 wrote to memory of 1488	1672	setup.exe	31
PID 1672 wrote to memory of 1488	1672	setup.exe	31
PID 1672 wrote to memory of 1488	1672	setup.exe	31
PID 1672 wrote to memory of 1488	1672	setup.exe	31
PID 1672 wrote to memory of 1488	1672	setup.exe	31
PID 1672 wrote to memory of 1488	1672	setup.exe	31
PID 1672 wrote to memory of 1488	1672	setup.exe	31
PID 1900 wrote to memory of 680	1900	install.exe	32
PID 1900 wrote to memory of 680	1900	install.exe	32
PID 1900 wrote to memory of 680	1900	install.exe	32
PID 1900 wrote to memory of 680	1900	install.exe	32
PID 1900 wrote to memory of 680	1900	install.exe	32
PID 1900 wrote to memory of 680	1900	install.exe	32
PID 1900 wrote to memory of 680	1900	install.exe	32
PID 680 wrote to memory of 1880	680	net.exe	35
PID 680 wrote to memory of 1880	680	net.exe	35
PID 680 wrote to memory of 1880	680	net.exe	35
PID 680 wrote to memory of 1880	680	net.exe	35
PID 680 wrote to memory of 1880	680	net.exe	35
PID 680 wrote to memory of 1880	680	net.exe	35
PID 680 wrote to memory of 1880	680	net.exe	35
PID 1488 wrote to memory of 1708	1488	net.exe	36
PID 1488 wrote to memory of 1708	1488	net.exe	36
PID 1488 wrote to memory of 1708	1488	net.exe	36
PID 1488 wrote to memory of 1708	1488	net.exe	36
PID 1488 wrote to memory of 1708	1488	net.exe	36
PID 1488 wrote to memory of 1708	1488	net.exe	36
PID 1488 wrote to memory of 1708	1488	net.exe	36
PID 1816 wrote to memory of 1232	1816	lsyci.exe	39
PID 1816 wrote to memory of 1232	1816	lsyci.exe	39
PID 1816 wrote to memory of 1232	1816	lsyci.exe	39
PID 1816 wrote to memory of 1232	1816	lsyci.exe	39
PID 1816 wrote to memory of 1232	1816	lsyci.exe	39
PID 1816 wrote to memory of 1232	1816	lsyci.exe	39
PID 1816 wrote to memory of 1232	1816	lsyci.exe	39

C:\Users\Admin\AppData\Local\Temp\9729f58618e8d6f9f82076ab505afc0090b2e15f5912e67b95718fb6e7e7d8b8.exe
"C:\Users\Admin\AppData\Local\Temp\9729f58618e8d6f9f82076ab505afc0090b2e15f5912e67b95718fb6e7e7d8b8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Users\Admin\AppData\Local\Temp\Messenger\install.exe
  "C:\Users\Admin\AppData\Local\Temp\Messenger\install.exe" m1_ly
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\lsyfi.exe
    "C:\Windows\lsyfi.exe" /service
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:588
- - C:\Windows\SysWOW64\net.exe
    net start NLPSA
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:680
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start NLPSA
      4⤵
      PID:1880
- C:\Users\Admin\AppData\Local\Temp\Messenger\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Messenger\setup.exe" m1_ly
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\SysWOW64\lsyci.exe
    "C:\Windows\system32\lsyci.exe" /service
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    PID:756
- - C:\Windows\SysWOW64\net.exe
    net start winmgmtex
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1488
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start winmgmtex
      4⤵
      PID:1708

C:\Windows\SysWOW64\lsyci.exe
C:\Windows\SysWOW64\lsyci.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32 "C:\Windows\SysWOW64\ohbxr.dll",DllCanUnloadNow
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:1232

C:\Windows\lsyfi.exe
C:\Windows\lsyfi.exe
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Messenger\install.exe

Filesize
20KB

MD5
77a8d625eb2e0585972b610d644371cd

SHA1
5b3a1932fe4ebcecdee450eeac6ad6dce2078808

SHA256
18a92c482c6fdb30ac0d0384f165c34018c807f39c79ec74f08047d2a89e86bd

SHA512
e4ef5ec88779e75f264ccbc699aee04c7801b09f437c52635751585271ce406c166ee01875747fa9e2bef104abff2718a9740c3bd2f145f19a59d9a4cfb28dae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Messenger\install.exe

Filesize
20KB

MD5
77a8d625eb2e0585972b610d644371cd

SHA1
5b3a1932fe4ebcecdee450eeac6ad6dce2078808

SHA256
18a92c482c6fdb30ac0d0384f165c34018c807f39c79ec74f08047d2a89e86bd

SHA512
e4ef5ec88779e75f264ccbc699aee04c7801b09f437c52635751585271ce406c166ee01875747fa9e2bef104abff2718a9740c3bd2f145f19a59d9a4cfb28dae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Messenger\mwsys.txt

Filesize
34B

MD5
57f46824055ffa1929b1533a1b23c5d3

SHA1
6596d10ca76e85d290c16b8d960ac796df5b20c3

SHA256
d83be47c672e36f47c460bafa4e3debe6ac256a0e1625b5c79fb0f9d2e3ba7a4

SHA512
25033f2c6a22d9b4e5241694d653917777ee9cfc6715035ab701945fe02b4073a824c239c7409dc2d88f06ba3473d9600309e42c170417153053ba4205a5b36c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Messenger\nlpsa.txt

Filesize
48KB

MD5
44567c8c8e3ee00c7425af6a91a942bb

SHA1
ca7606b9cda45f899b7d6a2c848f27cf74a5f712

SHA256
5cbcbde84990728895fa76768f288d94404aa273e3e19f22b08abf61cfb97c0e

SHA512
96cf2cf362fef46bd7060f0869a7c8df6baa3f197294a3bd4e05ff929dcfd3ee02c2ace5d78f35a01c8b273c8542adaffbfdb5bdcb4ec2b75197f6bca31b0137

Download Submit
C:\Users\Admin\AppData\Local\Temp\Messenger\nvsys.ini

Filesize
44B

MD5
a53c6221be50368b645091bed7c49fbd

SHA1
c7b382b75fc50609f9abffbc5afa8653b1ac0510

SHA256
2d3936d0326657e91e3de93181976806ba9e8f8a44efdb9b598470998b050e98

SHA512
12af2c5c48183f0548f874207d639e30f55b8ea0ba2a3aa262e08e2d66664ec3edc6b6258dd9d7cec5f1f99fefae5eba9152d222a432083649c3a8c974838620

Download Submit
C:\Users\Admin\AppData\Local\Temp\Messenger\setup.exe

Filesize
20KB

MD5
25611a17e8fa86c06f72805ee366bf88

SHA1
c2545e739bb3e5c8e6444ca2f2e862c2f96efce7

SHA256
5a7170ed849ce5d0c68d692242e49b93d92cf42b61f26bdfd267b814bb16d87b

SHA512
bc71e5f5830db7532e88fa25ba231ab0a1b50b48c0e46e309793fb1ee4c00e9b3aa0f1f39a2df0dea5c634102d704bd0de1a86aaa9db9928e3b2c40b56bdf55a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Messenger\setup.exe

Filesize
20KB

MD5
25611a17e8fa86c06f72805ee366bf88

SHA1
c2545e739bb3e5c8e6444ca2f2e862c2f96efce7

SHA256
5a7170ed849ce5d0c68d692242e49b93d92cf42b61f26bdfd267b814bb16d87b

SHA512
bc71e5f5830db7532e88fa25ba231ab0a1b50b48c0e46e309793fb1ee4c00e9b3aa0f1f39a2df0dea5c634102d704bd0de1a86aaa9db9928e3b2c40b56bdf55a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Messenger\sysmain.dat

Filesize
72KB

MD5
2faf28a33db1011d34fd366e135269aa

SHA1
fb4bc6f51087b5cd7044a1c60f408631d8bb422e

SHA256
4afdcf172222ceb8101a295c296763c1bf15f72359c488f01f4aa1f822390529

SHA512
460d5bb59368ae914a65ce2ec13e561ff99176ebc5fa45d1594a057060c87401a28dc5b3d4181fea4bb31db3a1048e68da6a72ae73210a73d64a24805d224027

Download Submit
C:\Users\Admin\AppData\Local\Temp\Messenger\sysvc.dat

Filesize
40KB

MD5
9a021dbd3152bf4d3dc38d9975f7be67

SHA1
28974032218ad790b04b40c98a129710b9f73c61

SHA256
ab1771260f5b6fe32973f7c9f4544883f46ebdecc9bc584c7613a6f0f4513e62

SHA512
6373fca5e3a33afc7c7c1937c97ffded60d3fc2a6d5a1aa072a486579b0ba1c9f0e1e49551381a87649657c90faa40aa3ad0f5d7e598e1e452c3ddba91fd81f5

Download Submit
C:\Windows\SysWOW64\lsyci.exe

Filesize
40KB

MD5
9a021dbd3152bf4d3dc38d9975f7be67

SHA1
28974032218ad790b04b40c98a129710b9f73c61

SHA256
ab1771260f5b6fe32973f7c9f4544883f46ebdecc9bc584c7613a6f0f4513e62

SHA512
6373fca5e3a33afc7c7c1937c97ffded60d3fc2a6d5a1aa072a486579b0ba1c9f0e1e49551381a87649657c90faa40aa3ad0f5d7e598e1e452c3ddba91fd81f5

Download Submit
C:\Windows\SysWOW64\lsyci.exe

Filesize
40KB

MD5
9a021dbd3152bf4d3dc38d9975f7be67

SHA1
28974032218ad790b04b40c98a129710b9f73c61

SHA256
ab1771260f5b6fe32973f7c9f4544883f46ebdecc9bc584c7613a6f0f4513e62

SHA512
6373fca5e3a33afc7c7c1937c97ffded60d3fc2a6d5a1aa072a486579b0ba1c9f0e1e49551381a87649657c90faa40aa3ad0f5d7e598e1e452c3ddba91fd81f5

Download Submit
C:\Windows\SysWOW64\mssrcid.ini

Filesize
38B

MD5
af9309b2ab8b161f21830846b9bbbe68

SHA1
909a1ed5f7b6cc41509ffb841dcad0992a8e4b52

SHA256
b66aa96674c6f5edeb8d41dd8c50b77c0a2507a98f1b8b213209b067fd5f1abc

SHA512
18f154e7a3ec880fec169d29842b84a1b0c24c00b8db5b451df9f0d2d9d17cd863b7e7519a04e9fe5d054a9881b31dc120ff03ffcdc1f85aa7868218507cdd3a

Download Submit
C:\Windows\lsyfi.exe

Filesize
48KB

MD5
44567c8c8e3ee00c7425af6a91a942bb

SHA1
ca7606b9cda45f899b7d6a2c848f27cf74a5f712

SHA256
5cbcbde84990728895fa76768f288d94404aa273e3e19f22b08abf61cfb97c0e

SHA512
96cf2cf362fef46bd7060f0869a7c8df6baa3f197294a3bd4e05ff929dcfd3ee02c2ace5d78f35a01c8b273c8542adaffbfdb5bdcb4ec2b75197f6bca31b0137

Download Submit
C:\Windows\lsyfi.exe

Filesize
48KB

MD5
44567c8c8e3ee00c7425af6a91a942bb

SHA1
ca7606b9cda45f899b7d6a2c848f27cf74a5f712

SHA256
5cbcbde84990728895fa76768f288d94404aa273e3e19f22b08abf61cfb97c0e

SHA512
96cf2cf362fef46bd7060f0869a7c8df6baa3f197294a3bd4e05ff929dcfd3ee02c2ace5d78f35a01c8b273c8542adaffbfdb5bdcb4ec2b75197f6bca31b0137

Download Submit
C:\Windows\sysrcid.ini

Filesize
49B

MD5
fd6fddb4d376b7c2a2db96a188ebc917

SHA1
d527793eedcdef9320e4c4318b3fe3bd7dac177f

SHA256
2a9982a142aad9a017c20702cc8d3358c63e7f0793b6c39c825be350cbdf5111

SHA512
854769f2b20cdaaa8a2994ef61ac7f4fa03e74bcacbadd5989e0e7356a9ca3adf43d687dfbec386c376ce57b0e19b1b6858192c1605bf1b27972e5d3623a58f5

Download Submit
\Users\Admin\AppData\Local\Temp\Messenger\install.exe

Filesize
20KB

MD5
77a8d625eb2e0585972b610d644371cd

SHA1
5b3a1932fe4ebcecdee450eeac6ad6dce2078808

SHA256
18a92c482c6fdb30ac0d0384f165c34018c807f39c79ec74f08047d2a89e86bd

SHA512
e4ef5ec88779e75f264ccbc699aee04c7801b09f437c52635751585271ce406c166ee01875747fa9e2bef104abff2718a9740c3bd2f145f19a59d9a4cfb28dae

Download Submit
\Users\Admin\AppData\Local\Temp\Messenger\install.exe

Filesize
20KB

MD5
77a8d625eb2e0585972b610d644371cd

SHA1
5b3a1932fe4ebcecdee450eeac6ad6dce2078808

SHA256
18a92c482c6fdb30ac0d0384f165c34018c807f39c79ec74f08047d2a89e86bd

SHA512
e4ef5ec88779e75f264ccbc699aee04c7801b09f437c52635751585271ce406c166ee01875747fa9e2bef104abff2718a9740c3bd2f145f19a59d9a4cfb28dae

Download Submit
\Users\Admin\AppData\Local\Temp\Messenger\install.exe

Filesize
20KB

MD5
77a8d625eb2e0585972b610d644371cd

SHA1
5b3a1932fe4ebcecdee450eeac6ad6dce2078808

SHA256
18a92c482c6fdb30ac0d0384f165c34018c807f39c79ec74f08047d2a89e86bd

SHA512
e4ef5ec88779e75f264ccbc699aee04c7801b09f437c52635751585271ce406c166ee01875747fa9e2bef104abff2718a9740c3bd2f145f19a59d9a4cfb28dae

Download Submit
\Users\Admin\AppData\Local\Temp\Messenger\install.exe

Filesize
20KB

MD5
77a8d625eb2e0585972b610d644371cd

SHA1
5b3a1932fe4ebcecdee450eeac6ad6dce2078808

SHA256
18a92c482c6fdb30ac0d0384f165c34018c807f39c79ec74f08047d2a89e86bd

SHA512
e4ef5ec88779e75f264ccbc699aee04c7801b09f437c52635751585271ce406c166ee01875747fa9e2bef104abff2718a9740c3bd2f145f19a59d9a4cfb28dae

Download Submit
\Users\Admin\AppData\Local\Temp\Messenger\setup.exe

Filesize
20KB

MD5
25611a17e8fa86c06f72805ee366bf88

SHA1
c2545e739bb3e5c8e6444ca2f2e862c2f96efce7

SHA256
5a7170ed849ce5d0c68d692242e49b93d92cf42b61f26bdfd267b814bb16d87b

SHA512
bc71e5f5830db7532e88fa25ba231ab0a1b50b48c0e46e309793fb1ee4c00e9b3aa0f1f39a2df0dea5c634102d704bd0de1a86aaa9db9928e3b2c40b56bdf55a

Download Submit
\Users\Admin\AppData\Local\Temp\Messenger\setup.exe

Filesize
20KB

MD5
25611a17e8fa86c06f72805ee366bf88

SHA1
c2545e739bb3e5c8e6444ca2f2e862c2f96efce7

SHA256
5a7170ed849ce5d0c68d692242e49b93d92cf42b61f26bdfd267b814bb16d87b

SHA512
bc71e5f5830db7532e88fa25ba231ab0a1b50b48c0e46e309793fb1ee4c00e9b3aa0f1f39a2df0dea5c634102d704bd0de1a86aaa9db9928e3b2c40b56bdf55a

Download Submit
\Users\Admin\AppData\Local\Temp\Messenger\setup.exe

Filesize
20KB

MD5
25611a17e8fa86c06f72805ee366bf88

SHA1
c2545e739bb3e5c8e6444ca2f2e862c2f96efce7

SHA256
5a7170ed849ce5d0c68d692242e49b93d92cf42b61f26bdfd267b814bb16d87b

SHA512
bc71e5f5830db7532e88fa25ba231ab0a1b50b48c0e46e309793fb1ee4c00e9b3aa0f1f39a2df0dea5c634102d704bd0de1a86aaa9db9928e3b2c40b56bdf55a

Download Submit
\Users\Admin\AppData\Local\Temp\Messenger\setup.exe

Filesize
20KB

MD5
25611a17e8fa86c06f72805ee366bf88

SHA1
c2545e739bb3e5c8e6444ca2f2e862c2f96efce7

SHA256
5a7170ed849ce5d0c68d692242e49b93d92cf42b61f26bdfd267b814bb16d87b

SHA512
bc71e5f5830db7532e88fa25ba231ab0a1b50b48c0e46e309793fb1ee4c00e9b3aa0f1f39a2df0dea5c634102d704bd0de1a86aaa9db9928e3b2c40b56bdf55a

Download Submit
\Windows\SysWOW64\lsyci.exe

Filesize
40KB

MD5
9a021dbd3152bf4d3dc38d9975f7be67

SHA1
28974032218ad790b04b40c98a129710b9f73c61

SHA256
ab1771260f5b6fe32973f7c9f4544883f46ebdecc9bc584c7613a6f0f4513e62

SHA512
6373fca5e3a33afc7c7c1937c97ffded60d3fc2a6d5a1aa072a486579b0ba1c9f0e1e49551381a87649657c90faa40aa3ad0f5d7e598e1e452c3ddba91fd81f5

Download Submit
\Windows\SysWOW64\lsyci.exe

Filesize
40KB

MD5
9a021dbd3152bf4d3dc38d9975f7be67

SHA1
28974032218ad790b04b40c98a129710b9f73c61

SHA256
ab1771260f5b6fe32973f7c9f4544883f46ebdecc9bc584c7613a6f0f4513e62

SHA512
6373fca5e3a33afc7c7c1937c97ffded60d3fc2a6d5a1aa072a486579b0ba1c9f0e1e49551381a87649657c90faa40aa3ad0f5d7e598e1e452c3ddba91fd81f5

Download Submit
\Windows\SysWOW64\lsyci.exe

Filesize
40KB

MD5
9a021dbd3152bf4d3dc38d9975f7be67

SHA1
28974032218ad790b04b40c98a129710b9f73c61

SHA256
ab1771260f5b6fe32973f7c9f4544883f46ebdecc9bc584c7613a6f0f4513e62

SHA512
6373fca5e3a33afc7c7c1937c97ffded60d3fc2a6d5a1aa072a486579b0ba1c9f0e1e49551381a87649657c90faa40aa3ad0f5d7e598e1e452c3ddba91fd81f5

Download Submit
\Windows\SysWOW64\lsyci.exe

Filesize
40KB

MD5
9a021dbd3152bf4d3dc38d9975f7be67

SHA1
28974032218ad790b04b40c98a129710b9f73c61

SHA256
ab1771260f5b6fe32973f7c9f4544883f46ebdecc9bc584c7613a6f0f4513e62

SHA512
6373fca5e3a33afc7c7c1937c97ffded60d3fc2a6d5a1aa072a486579b0ba1c9f0e1e49551381a87649657c90faa40aa3ad0f5d7e598e1e452c3ddba91fd81f5

Download Submit
\Windows\SysWOW64\lsyci.exe

Filesize
40KB

MD5
9a021dbd3152bf4d3dc38d9975f7be67

SHA1
28974032218ad790b04b40c98a129710b9f73c61

SHA256
ab1771260f5b6fe32973f7c9f4544883f46ebdecc9bc584c7613a6f0f4513e62

SHA512
6373fca5e3a33afc7c7c1937c97ffded60d3fc2a6d5a1aa072a486579b0ba1c9f0e1e49551381a87649657c90faa40aa3ad0f5d7e598e1e452c3ddba91fd81f5

Download Submit
\Windows\SysWOW64\ohbxr.dll

Filesize
72KB

MD5
2faf28a33db1011d34fd366e135269aa

SHA1
fb4bc6f51087b5cd7044a1c60f408631d8bb422e

SHA256
4afdcf172222ceb8101a295c296763c1bf15f72359c488f01f4aa1f822390529

SHA512
460d5bb59368ae914a65ce2ec13e561ff99176ebc5fa45d1594a057060c87401a28dc5b3d4181fea4bb31db3a1048e68da6a72ae73210a73d64a24805d224027

Download Submit
\Windows\SysWOW64\ohbxr.dll

Filesize
72KB

MD5
2faf28a33db1011d34fd366e135269aa

SHA1
fb4bc6f51087b5cd7044a1c60f408631d8bb422e

SHA256
4afdcf172222ceb8101a295c296763c1bf15f72359c488f01f4aa1f822390529

SHA512
460d5bb59368ae914a65ce2ec13e561ff99176ebc5fa45d1594a057060c87401a28dc5b3d4181fea4bb31db3a1048e68da6a72ae73210a73d64a24805d224027

Download Submit
\Windows\SysWOW64\ohbxr.dll

Filesize
72KB

MD5
2faf28a33db1011d34fd366e135269aa

SHA1
fb4bc6f51087b5cd7044a1c60f408631d8bb422e

SHA256
4afdcf172222ceb8101a295c296763c1bf15f72359c488f01f4aa1f822390529

SHA512
460d5bb59368ae914a65ce2ec13e561ff99176ebc5fa45d1594a057060c87401a28dc5b3d4181fea4bb31db3a1048e68da6a72ae73210a73d64a24805d224027

Download Submit
\Windows\SysWOW64\ohbxr.dll

Filesize
72KB

MD5
2faf28a33db1011d34fd366e135269aa

SHA1
fb4bc6f51087b5cd7044a1c60f408631d8bb422e

SHA256
4afdcf172222ceb8101a295c296763c1bf15f72359c488f01f4aa1f822390529

SHA512
460d5bb59368ae914a65ce2ec13e561ff99176ebc5fa45d1594a057060c87401a28dc5b3d4181fea4bb31db3a1048e68da6a72ae73210a73d64a24805d224027

Download Submit
memory/1228-54-0x0000000075561000-0x0000000075563000-memory.dmp

Filesize
8KB

Download